The rapid expansion of the data communications industry, in particular the Internet and the World Wide Web (WWW), sometimes referred to as the superinformation highway, has provided data processing system users with what is effectively a global communication network interconnecting a vast number of databases and other network users. The local link between the network and the user is typically by way of a phone line (e.g., analog or ISDN, for example) of a public communication service provider, with the workstation hardware including a modem or terminal adapter equipment that allows dial-up access between the user and a remote party. Since a user's workstation is coupled directly to such interface equipment, any network user ostensibly has the ability to access any information resource coupled to a network node.
As a reduced complexity, non-limiting example, FIG. 1 diagrammatically illustrates a network user workstation 10 which is coupled via a communication link 11 to a local area network (LAN) 20 by way of a LAN interface 13. LAN interface 13 also provides access to an external network, such as a public communication services (PCS) network, including the Internet 30, that provides potential access to any network information resource (e.g., processor-accessible digital database). The local area network 20 to which user 10 is connected customarily includes one or more computer-based units, such as the illustrated workstations 21 and 22, network server 23 and printer 24, which are interconnected via a hub 25. The hub 25 is connected to the LAN interface 13, so that the end user workstation 10 may access any `local` information resource of the LAN 20. In order to connect to the external network 30, the network interface 13 may be coupled through an electronic mail gateway 32 and a modem 33, whereby a dial-up connection may be provided to an Internet connection or other global resource provider 34, through which access to any node in the overall network is achieved.
Because the network provides a potential window into any information resource linked to any of its nodes, it is customary to both wrap or embed all communications in a `security blanket` (some form of encryption) at a communication sourcing end, and to employ one or more permission (authorization and authentication) layers that must be used to gain access to another system resource (e.g., another computer). Once installed, such schemes operate as micro security systems, primarily as binary permission filters--the user is either permitted or denied access to a destination information resource, and are customarily limited to a relatively limited (and often fixed) set of access permission criteria. Now, while such schemes provide some measure of access control, they do not provide a macro perspective or control of all of the resources for which a given network security system may be configured.